Vulnerability Description
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. This issue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/deploypackage.public.php` file if they are not using the `deploy tasks` feature.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Glpi-Project | Glpi Inventory | < 1.0.2 |
Related Weaknesses (CWE)
References
- https://github.com/glpi-project/glpi-inventory-plugin/commit/0b805ca6fb2a0f9bde4PatchThird Party Advisory
- https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-qMitigationThird Party Advisory
- https://github.com/glpi-project/glpi-inventory-plugin/commit/0b805ca6fb2a0f9bde4PatchThird Party Advisory
- https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-qMitigationThird Party Advisory
FAQ
What is CVE-2022-31082?
CVE-2022-31082 is a vulnerability with a CVSS score of 5.8 (MEDIUM). GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle invent...
How severe is CVE-2022-31082?
CVE-2022-31082 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-31082?
Check the references section above for vendor advisories and patch information. Affected products include: Glpi-Project Glpi Inventory.